Skip to the content

Cases, incidents and notification clocks

Incidents with the clocks each law starts, and actions a second person approves.

In the consoleCases

Choose the regimes that apply
```
aertun incident regimes eu nis2
```
With none set, a new incident starts with no obligations and no clocks.

Declare an incident

aertun incident declare --title "Token used from an unknown country" --grade sev2 --finding ID

Start the clocks
A clock starts when somebody decides the organisation is aware, and that decision is recorded with its reason.
```
aertun incident decide ID aware --because "..."
aertun incident duties
```

Discharge or waive each duty

aertun incident discharge ID "NIS2 early warning" --because "sent to the CSIRT"
aertun incident waive ID "GDPR Article 34" --because "no personal data involved"

Work a playbook

aertun incident playbooks
aertun incident propose ID account-compromise
aertun incident step ID account-compromise STEP done --because "..."

The shipped playbooks cover account compromise, phishing, malware on an endpoint, a lost device and exposed data.

Act on another platform, with a second person

aertun action add okta-suspend-user --org example
aertun incident act ID okta-suspend-user okta:USER --because "..."
aertun incident act-approve ID 1

The exact request is shown before anybody approves it, and it is sent only when a second person does.

The deadlines are the published ones, counted from the decision, not legal advice. Notices to the people affected are drafted, planned and sent with aertun notify.